OllyEye v0.1

Sometimes we want to find out where in a module the code parsing is done. In the example below, we want to find the code that parses the QuickTime video codecs that are in Windows media player. We know that the codecs support the raw, rle, jpeg, mjpb, and rpza tags, so all we need to do is to search for those tags in our module--in this case, the "quartz.dll" module.

The OllyEye hunter knows that it should check for the video codec’s tags such as code.equals ("rpza") and that in assembly it should be done with the CMP command that represents it. For this reason, it searches for the CMP command that matches the 'rpza' keyword.

OllyEyev0.1.rar